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REMARKS 

By this amendment, claims 1-15 are pending, in which claims 3-4 are currently amended, 
and claims 12-15 are newly presented. No new matter is introduced. 

The Office Action mailed February 3, 2005 objected to claim 4 and rejected claims 1, 3, 
5, 8, 10 as obvious under 35 U.S.C. § 103 based on Hypponen et al (US 2003/0191957) in view 
of Hodges et al (US 6,035,423); claims 2, 4, 7, and 9 over Hypponen et al and Hodges et al 
further in view of Almogy et al (US 2002/0194489); and claims 6 and 11 over Hypponen et al 
and Hodges et al further in view of Caccavale (US 2002/0129277). 

Claim 4 is amended as helpfully suggested by the Examiner in response to the objection. 
Claim 3 is amended to fix a typographical error. The Specification is amended to update a cross- 
reference to a co-pending application. 

The rejection of claims 1-11 is respectfully traversed because neither Hypponen et al nor 

Hodges et al teach or otherwise the features of the claims. For example, independent claim 1 

recites (emphasis added): 

1. (Original) A network security system to be deployed between a plurality 
of intranets belonging to respective organizations and an internet backbone, 
comprising: 

a scanning system coupled to the intranets for scanning incoming electronic 

mail for malicious code; 
an anti-virus server coupled to the intranets for downloading anti-virus code to 

clients coupled to the intranets; and 
a switch coupled between the internet backbone, the scanning system, and the 

anti-virus server, said switch configured for: 

directing incoming electronic mail from the internet backbone to the 
scanning system. 

Accordingly, claim 1 recites a "scanning system coupled to the intranets for scanning 
incoming electronic mail for malicious code" in a "network security system to be deployed 
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between a plurality of intranets belonging to respective organizations and an internet 
backbone." This feature is not teach or other suggested in either Hypponen et al or Hodges et al 
Hypponen et al is directed to distributed computer virus detection and scanning (Title). 
Referring to FIG. 1 and the Abstract, Hypponen et al describes a "method of detecting viruses in 
a computer network 1 comprising intercepting data at at least one data transit node 4 of the 
network 1. The transit node 4 . . . transfers the identified data to a virus scanning server 7 over 
the network 1." However, Hypponen et al only shows one computer data network 1 in addition 
to the Internet 5 and has no disclose of a "plurality of intranets," much less a "scanning system 
coupled to the intranets." Although the Office Action, p. 2, reads an "intranet" on the network 1 
of Hypponen et al, every feature of the claims, including the plural "intranets," much be found in 
the applied references, and Hypponen et al lacks the recited plural "intranets." 

Hodges et al too fails to disclose the plural "intranets" recited in the claims. Though the 
Office Action did not rely on Hodges et al for this claim feature, it is evident from FIG. 10 of 
Hodges et al, that there is only one corporate computer network 1006 on its side of the internet 
1004. 

Independent claim 3 too is allowable over Hypponen et al and Hodges et al because 
neither reference shows "a scanning system coupled to the intranets for scanning incoming 
electronic mail for malicious code." As for independent claim 5, nether Hypponen et al nor 
Hodges et al show a "plurality of scanning systems coupled to the intranets for scanning 
incoming electronic mail for malicious code." 

Independent claim 8 and 10 recite: "downloading anti-virus code to clients coupled to the 
intranets." As neither Hypponen et al nor Hodges et al show plural intranets, they do not render 
independent claims 8 and 10 obvious. 
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Dependent claims 2, 4, 6, 7, 9, and 1 1 are patentable for at least the same reasons as their 
independent claims and are individually patentable on their own merits. For example, none of 
the secondary references, Almogy et al and Caccavale, disclose the "plurality of intranets 
belonging to respective organizations." 

As another example, Almogy et al does not disclose the "decoy server coupled to the 
intranets for masquerading as a legitimate server and logging activity on conmiunications 
received via the internet backbone" as recited in claims 2 and 4. In fact, Almogy et al does not 
even show a "decoy server" nor a server that masquerades as a legitimate server as recited in 
claim 2, but what it calls "decoy addresses." Paragraph 153 (p. 7) of Almogy et al states: "one or 
more decoy addresses are inserted into either or both address book 102 and folders 104." Almogy 
et a/.'s decoys are entities that are inserted into an address book; they are not servers. 

Dependent claim 7 recites "a plurality of decoy servers coupled to the intranets for 
masquerading as legitimate servers and logging activity on communications received via the 
internet backbone." Since Almogy et al does not even show one such decoy server, it clearly 
does not show a plurality of such decoy servers. 

Moreover, dependent claim 9 recites: "simulating the decoy server as a legitimate server 
to the suspicious traffic." Almogy et a/.'s decoy addresses are not simulated as a legitimate 
server. 

New dependent claims 12-15 further recite directing sanitized incoming electronic mail to 
the recipients on the intranets. 

Therefore, the present application, as amended, overcomes the objections and rejections 
of record and is in condition for allowance. Favorable consideration is respectfully requested. If 
any unresolved issues remain, it is respectfully requested that the Examiner telephone the 
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undersigned attorney at 703-425-8516 so that such issues may be resolved as expeditiously as 
possible. 

Respectfully Submitted, 
DITTHAVONG & CARLSON, P.C. 




10507 Braddock Road 
Suite A 

Fairfax, VA 22032 
Tel. 703-425-8516 
Fax. 703-425-8518 




Stephen C. Carlson 

Attorney/ Agent for Applicant(s) 

Reg. No. 39929 
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